Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 00:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DepthsRevivals.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
DepthsRevivals.exe
Resource
win10v2004-20240426-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
msimg32.dll
Resource
win7-20240508-en
2 signatures
150 seconds
General
-
Target
DepthsRevivals.exe
-
Size
6.1MB
-
MD5
4864a55cff27f686023456a22371e790
-
SHA1
6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
-
SHA256
08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
-
SHA512
4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
-
SSDEEP
98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\ChromeData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
DepthsRevivals.exepid process 2916 DepthsRevivals.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
DepthsRevivals.execmd.exedescription pid process target process PID 2916 wrote to memory of 3024 2916 DepthsRevivals.exe DepthsRevivals.exe PID 2916 wrote to memory of 3024 2916 DepthsRevivals.exe DepthsRevivals.exe PID 2916 wrote to memory of 3024 2916 DepthsRevivals.exe DepthsRevivals.exe PID 2916 wrote to memory of 3024 2916 DepthsRevivals.exe DepthsRevivals.exe PID 2916 wrote to memory of 3024 2916 DepthsRevivals.exe DepthsRevivals.exe PID 2916 wrote to memory of 3024 2916 DepthsRevivals.exe DepthsRevivals.exe PID 2916 wrote to memory of 3024 2916 DepthsRevivals.exe DepthsRevivals.exe PID 2916 wrote to memory of 2564 2916 DepthsRevivals.exe cmd.exe PID 2916 wrote to memory of 2564 2916 DepthsRevivals.exe cmd.exe PID 2916 wrote to memory of 2564 2916 DepthsRevivals.exe cmd.exe PID 2916 wrote to memory of 2564 2916 DepthsRevivals.exe cmd.exe PID 2564 wrote to memory of 2660 2564 cmd.exe reg.exe PID 2564 wrote to memory of 2660 2564 cmd.exe reg.exe PID 2564 wrote to memory of 2660 2564 cmd.exe reg.exe PID 2564 wrote to memory of 2660 2564 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"2⤵PID:3024
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f3⤵
- Adds Run key to start application
PID:2660
-
-